ci: label the freshness pin with its release - #245
Merged
Conversation
The pin already pointed at the commit that became v1.11.0 — it was pinned to the merge of Glyndor/.github#105 while the reusable was still waiting for a consumer to prove it green, which this repository then did. The SHA is what makes the pin safe; the version comment beside it is what makes it visible. Without one Dependabot has no version to compare against, so it never proposes a bump and the pin quietly rots. That is the difference between a reusable this repository happens to call and one the organisation can adopt. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
Jaro-c
added
type:ci
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #219.
The pin already pointed at the commit that became
v1.11.0— it was pinned to the merge of Glyndor/.github#105 while the reusable was still waiting for a consumer to prove it green, which #226 then did. This adds the version comment beside it.The SHA is what makes the pin safe. The comment is what makes it visible: without a version to compare against, Dependabot never proposes a bump and the pin quietly rots. That is the difference between a reusable this repository happens to call and one the organisation can adopt.
Where #219 stands
Security auditandFuzzboth fired on 2026-07-27 — 09:55 and 10:30 UTC, against crons set for 06:00 and 07:00. Nearly four hours late, which is normal for GitHub and worth remembering before calling one dead.audit.ymlhad never completed a scheduled run successfully; its only previous cron-triggered run, on 2026-06-29, is the one that failed.Within the 15-day limitonce they resumed.Closing #219 on the authcore side. What is not done is the rollout: epistle, unitpm, glyndor.net, apt and podup all carry schedules and none of them has a freshness check. That is org work and needs its own issue rather than living in this one.